Security readout for executives and security teams
Plain-English summary
This is an availability risk for Hirschmann EagleSDV devices. A vulnerable version can crash while establishing TLS sessions using TLS 1.0 or TLS 1.1, interrupting service. The issue is network-reachable and does not require authentication, so exposed devices should be prioritized for vendor-guided remediation.
Executive priority
Treat this as a high-priority operational resilience issue where EagleSDV devices support production or safety-adjacent networks. Prioritize exposed or broadly reachable devices first, then complete firmware validation through normal industrial change controls.
Technical view
CVE-2022-4986 is a CWE-400 denial-of-service flaw in Hirschmann EagleSDV 05.4.01 prior to 05.4.02. The crash occurs during TLS session establishment when TLS 1.0 or TLS 1.1 is used. The CVSS 4.0 score is 8.7, driven by network access, low complexity, no privileges, no user interaction, and high availability impact.
Likely exposure
Likely exposure is limited to organizations running Hirschmann EagleSDV 05.4.01 or earlier affected builds with TLS services reachable over a network. Risk is higher where management or operational interfaces are reachable from broad internal networks or untrusted zones.
Exploitation context
The provided sources and KEV status do not show confirmed active exploitation. The vulnerability appears straightforward to trigger because it is network-accessible and unauthenticated, but the source bundle does not provide public exploitation evidence beyond the described denial-of-service condition.
Researcher notes
The source bundle describes a TLS 1.0/1.1 session-establishment crash and CVSS 4.0 availability impact only. It does not establish confidentiality or integrity impact, active exploitation, or a workaround beyond vendor remediation. The affected-version metadata appears inconsistent, so verify against Belden’s advisory.
Mitigation direction
- Upgrade affected EagleSDV devices to version 05.4.02 or vendor-recommended later releases.
- Review Belden advisory BSECV-2022-08 for exact affected versions and operational guidance.
- Restrict network access to EagleSDV TLS services to trusted management segments.
- Review whether TLS 1.0 and TLS 1.1 can be disabled per vendor guidance.
- Monitor impacted environments for unexpected EagleSDV crashes or service interruptions.
Validation and detection
- Inventory Hirschmann EagleSDV devices and record firmware versions.
- Confirm whether any device runs 05.4.01 or another vendor-listed affected version.
- Identify reachable TLS services and their network exposure boundaries.
- Check change records for upgrade to 05.4.02 or later vendor-approved firmware.
- Review device logs for crash patterns during TLS session establishment.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4986 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://assets.belden.com/m/1c8fe5d916567af6/original/Belden_Security_Bulletin_BSECV-2022-08.pdfCVE reference, VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/hirschmann-eaglesdv-denial-of-service-via-tlsCVE reference, VulnCheck
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.